# TestDisk: undelete file for FAT

### From CGSecurity

This Recovery example guides you through TestDisk step by step to undelete files from FAT filesystem. It's possible to recover your deleted files: when a file is deleted, the filename is marked as deleted and the data as unallocated/free, but TestDisk can read the deleted directory entry and find where the file was beginning. If the data space hasn't been overwritten by a new file, the file is recoverable.

## Start the undelete process

- Select Advanced

- Select the partition that was holding the lost files and choose Undelete

## FAT file undelete

Deleted files and directories are displayed in red.

- To undelete a file, select the file to recover and press 'c' to copy the file.
- To recover a deleted directory, select the directory and press 'c' to undelete the directory and its content.

## Select where recovered files should be written

Select the destination

## FAT file recovery is completed

When you get your files back, use Quit to exit.

For a maximum of security, TestDisk doesn't try to unerase files but let you copy the deleted files on another partition or disk. Remember you must avoid to write anything on the filesystem that was holding the data, otherwise deleted files may be overwritten by new ones.

TestDisk can undelete

- files and directory from FAT12, FAT16 and FAT32 filesystem,
- files from NTFS partition since version 6.11,
- files from ext2 filesystem.

If a lost file is still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed.

Category: Data Recovery